CertCrack

AWS Solutions Architect Associate · SAA-C03

SAA-C03 Practice Exam: 730 Questions with Explanations

Preparing for the AWS Certified Solutions Architect – Associate (SAA-C03) certification? CertCrack gives you 730 original practice questions mapped to the official SAA-C03 exam guide — secure architectures (30%), resilient architectures (26%), high-performing architectures (24%), and cost-optimized architectures (20%). Every question includes a detailed explanation so you learn the why, not just the answer.

What's inside

Try 30 sample questions

These are real samples from the SAA-C03 bank — the full version has 730 like these.

1. A company runs a fleet of Amazon EC2 instances that process files uploaded to an Amazon S3 bucket. The application needs read access to the bucket, but the security team forbids storing any long-term AWS credentials on the instances. Which approach meets these requirements with the least operational overhead?

  1. Create an IAM user with programmatic access, store the access keys in an encrypted file on each instance, and rotate the keys every 90 days.
  2. Attach an S3 bucket policy that grants s3:GetObject to the public internet, and restrict access using the instances' security groups.
  3. Store the IAM user's credentials in AWS Secrets Manager and have the application retrieve them at startup.
  4. Create an IAM role with an S3 read-only policy, attach it to the EC2 instances through an instance profile.
Correct answer: D. Correct: An IAM role attached via an instance profile gives the instances temporary, automatically rotated credentials with no long-term secrets to manage. Why others are wrong: A) Storing long-term access keys on instances violates the no-long-term-credentials requirement and adds rotation burden. B) A public bucket policy exposes the bucket to the entire internet, and security groups cannot restrict S3 public access. C) Secrets Manager still relies on long-term IAM user credentials, which the security team forbade.

2. Before deploying a new IAM policy, an engineer wants to check it for overly permissive grants such as allowing iam:PassRole to all resources. Which feature provides automated pre-deployment policy checks with findings mapped to security best practices?

  1. AWS CloudTrail Insights, which analyzes management events for anomalies.
  2. IAM Access Analyzer policy checks, which validate policies against best practices and flag findings like overly broad access before deployment.
  3. AWS Config timeline, which records historical policy versions.
  4. Amazon Inspector, which scans the policy document for CVEs.
Correct answer: B. Correct: IAM Access Analyzer includes policy checks that validate JSON policies against AWS best practices (security, errors, warnings) before they are deployed. Why others are wrong: A) CloudTrail Insights detects unusual API activity patterns, not static policy issues. C) Config records configuration history but does not validate policy content. D) Inspector scans compute workloads for vulnerabilities, not IAM policy documents.

3. A regulated workload requires single-tenant HSMs where the customer has exclusive control of the hardware and AWS operators cannot access key material. Which service meets this requirement?

  1. AWS KMS with customer managed keys, because CMKs are single-tenant.
  2. AWS CloudHSM, which provides dedicated single-tenant HSM instances in the customer's VPC under their exclusive control.
  3. AWS Secrets Manager, which stores keys in dedicated hardware by default.
  4. KMS custom key stores backed by CloudHSM, which are multi-tenant but encrypted.
Correct answer: B. Correct: CloudHSM provisions dedicated, single-tenant HSM appliances in your VPC where only you hold the credentials — AWS has no access to the keys. Why others are wrong: A) KMS is multi-tenant (FIPS 140-2 validated HSMs shared across customers); CMKs don't change tenancy. C) Secrets Manager is not HSM-backed dedicated hardware. D) A custom key store backed by CloudHSM IS single-tenant — describing it as multi-tenant is wrong, and plain CloudHSM is the direct answer.

4. A bucket receives uploads from three different AWS accounts via cross-account PUTs. The bucket owner cannot read some uploaded objects. What setting fixes ownership so the bucket owner controls all objects?

  1. Enable S3 Versioning, which transfers ownership to the bucket owner.
  2. Set Object Ownership to 'Bucket owner enforced', which disables ACLs and makes the bucket owner the owner of every object.
  3. Add a bucket policy granting the bucket owner s3:GetObject on all objects.
  4. Enable MFA Delete on the bucket.
Correct answer: B. Correct: 'Bucket owner enforced' disables ACLs entirely and vests ownership of all objects (including cross-account uploads) in the bucket owner. Why others are wrong: A) Versioning doesn't change object ownership. C) A bucket policy can't override the fact that the object owner (another account) controls the ACL. D) MFA Delete protects against deletion, not ownership.

5. A bucket policy should allow uploads only from the company's CloudFront distribution (using Origin Access Control). Which condition key identifies the CloudFront distribution as the requester?

  1. aws:SourceArn matching the distribution ARN, used with the CloudFront service principal.
  2. aws:PrincipalTag matching the distribution ID.
  3. s3:x-amz-acl set to cloudfront-origin.
  4. aws:SourceIp matching CloudFront's IP ranges.
Correct answer: A. Correct: With OAC, CloudFront signs origin requests and the bucket policy uses aws:SourceArn = distribution ARN to ensure only that distribution can fetch objects. Why others are wrong: B) PrincipalTag isn't how CloudFront identifies itself to S3. C) x-amz-acl controls canned ACLs on uploads, not origin identity. D) IP ranges are broad and shared across customers — not a secure identity check.

6. A company provides an interface VPC endpoint for SQS so applications can poll queues privately. It wants the endpoint usable only for two specific queues. How is this enforced?

  1. In the security group attached to the endpoint's ENIs.
  2. By enabling private DNS, which restricts queue names.
  3. With a VPC endpoint policy on the interface endpoint allowing sqs:* only on the two queue ARNs.
  4. With an SCP denying sqs:ReceiveMessage for other queues.
Correct answer: C. Correct: Interface endpoints support endpoint policies that filter which API actions and resources are reachable through that endpoint. Why others are wrong: A) Security groups filter by IP/port, not by queue ARN. B) Private DNS controls name resolution, not authorization. D) SCPs apply at the account level, not per-endpoint, and are a blunter instrument.

7. After deploying AWS WAF, the security team wants full request logs for forensics, including blocked requests with headers. Where can WAF send detailed logs?

  1. WAF full logging to Amazon S3, CloudWatch Logs, or Kinesis Data Firehose, capturing each inspected request and the rule action taken.
  2. WAF logs are only visible in the console for 24 hours.
  3. VPC Flow Logs automatically include WAF decisions.
  4. CloudTrail data events for WAF contain full request bodies.
Correct answer: A. Correct: WAF supports full logging destinations (S3, CloudWatch Logs, Firehose) with per-request details including matched rules and headers. Why others are wrong: B) WAF has no console-only 24-hour log view — logging must be configured. C) Flow Logs capture network tuples, not WAF decisions. D) CloudTrail logs WAF management API calls, not inspected web requests.

8. A CI/CD pipeline pushes container images to ECR. The team wants every image scanned for CVEs on push, with critical findings blocking deployment. Which setup achieves this?

  1. Enable ECR basic scanning, which scans on push with Inspector-level detail.
  2. Configure GuardDuty to scan ECR images on push.
  3. Enable Inspector's ECR enhanced scanning (continuous/on-push) and use EventBridge on Inspector findings to block the pipeline on critical CVEs.
  4. Use AWS WAF to scan image layers.
Correct answer: C. Correct: Inspector's enhanced ECR scanning assesses images on push (and continuously), and EventBridge can gate deployments on critical findings. Why others are wrong: A) Basic scanning uses a different engine with less detail than Inspector enhanced scanning. B) GuardDuty doesn't scan image CVEs. D) WAF doesn't inspect container images.

9. The security team needs one view of Config rule compliance across all accounts and Regions. Which component provides centralized aggregation?

  1. A Config aggregator in the security account, collecting configuration and compliance data from source accounts/Regions.
  2. CloudTrail Lake, which aggregates Config data natively.
  3. One Config recorder per account with S3 cross-Region replication.
  4. GuardDuty's delegated administrator.
Correct answer: A. Correct: The Config aggregator is purpose-built to centralize configuration items and rule compliance across accounts and Regions. Why others are wrong: B) CloudTrail Lake handles trail events, not Config compliance. C) Recorder replication moves raw data without compliance aggregation. D) GuardDuty's admin model doesn't aggregate Config data.

10. A company manages an Auto Scaling group for its web tier using launch configurations. The operations team needs to version configuration changes, specify multiple instance types with mixed Spot and On-Demand strategies, and reuse the same configuration across several Auto Scaling groups. What should the solutions architect recommend?

  1. Migrate to launch templates, which support versioning, multiple instance types, and mixed Spot and On-Demand purchase options.
  2. Continue using launch configurations, because they natively support versioning and Spot allocation strategies.
  3. Replace the Auto Scaling group with manually managed EC2 instances configured with user data scripts.
  4. Create a new launch configuration for every change and rotate them manually across the groups.
Correct answer: A. Correct: Launch templates support versioning, multiple instance types, mixed instances policies, and reuse across groups; launch configurations are immutable and lack these features. Why others are wrong: B) Launch configurations do not support versioning, multiple instance types, or mixed purchase options. C) Manual instances lose auto scaling, self-healing, and multi-AZ distribution. D) Manual rotation is error-prone operational overhead and still lacks versioning and mixed-instance support.

11. A company runs five microservices as separate target groups. All services must be exposed through a single HTTPS endpoint, with requests routed by URL path such as /orders, /payments, and /inventory. Which load balancer natively supports this?

  1. Network Load Balancer with path-based listener rules.
  2. Gateway Load Balancer with GENEVE path headers.
  3. Classic Load Balancer with URL routing rules.
  4. Application Load Balancer with path-based listener rules forwarding to each microservice's target group.
Correct answer: D. Correct: ALB is a Layer 7 load balancer whose listener rules route on URL path to different target groups. Why others are wrong: A) NLB operates at Layer 4 and cannot inspect HTTP paths. B) GWLB transparently forwards to appliances; it does not do HTTP path routing. C) Classic Load Balancer has only basic Layer 7 support without advanced path-based rules.

12. A media company needs a sophisticated routing setup: geoproximity routing between Regions, with failover to a backup endpoint inside each Region. Building this from individual record sets is becoming unmanageable. Which Route 53 feature simplifies creating and versioning this complex policy?

  1. Simple routing with high TTL values.
  2. Health checks with string matching only.
  3. Route 53 Traffic Flow traffic policies, which provide a visual editor, versioning, and support for combining geoproximity with failover rules.
  4. Private hosted zones with identical record names.
Correct answer: C. Correct: Traffic Flow supports complex nested policies like geoproximity-plus-failover with versioning. Why others are wrong: A) Simple routing cannot express geoproximity or failover logic. B) String matching only refines health checks, not routing structure. D) Private hosted zones affect visibility scope, not routing policy complexity.

13. A company maintains a golden AMI for its application servers in us-east-1. For regional disaster recovery, identical server images must be launchable in eu-west-1. What is the most direct way to make the AMI available in the second Region?

  1. Copy the AMI to eu-west-1, which copies the underlying snapshots and registers a new AMI in that Region.
  2. Share the AMI publicly so it appears in all Regions.
  3. Download the AMI to on-premises storage and upload it to eu-west-1.
  4. Recreate the AMI manually by rebuilding the server in eu-west-1.
Correct answer: A. Correct: AMI copy replicates snapshots and registers the AMI in the target Region natively. Why others are wrong: B) Sharing controls access; it does not replicate the AMI across Regions. C) AMIs cannot be downloaded and re-uploaded; there is no export path for this. D) Manual rebuilds are slow and risk configuration drift.

14. An operator accidentally deleted a large set of items from a DynamoDB table 30 minutes ago. The table has point-in-time recovery enabled. What is the fastest way to restore the deleted items?

  1. Restore from the last on-demand backup taken last night.
  2. Replay the application logs to rewrite the items.
  3. Use DynamoDB Streams to reconstruct the deletes.
  4. Restore the table to a point in time just before the deletion using point-in-time recovery.
Correct answer: D. Correct: Point-in-time recovery restores to any second within the preceding 35 days, covering the 30-minute-old deletion. Why others are wrong: A) Last night's backup loses a full day of writes. B) Log replay is manual, slow, and error-prone. C) Streams capture changes but do not provide a restore mechanism.

15. During a DR planning session, stakeholders confuse recovery objectives. Which statement correctly distinguishes RTO from RPO?

  1. RTO measures how much data can be lost; RPO measures how fast systems recover.
  2. RTO and RPO are interchangeable terms for backup frequency.
  3. RTO is the maximum acceptable downtime before service restoration; RPO is the maximum acceptable data loss measured in time.
  4. RPO measures recovery cost; RTO measures recovery team size.
Correct answer: C. Correct: RTO bounds downtime duration; RPO bounds data loss as a time window. Why others are wrong: A) It swaps the definitions. B) They measure different dimensions and are not interchangeable. D) Neither measures cost or team size.

16. A fleet polls a low-volume queue with short polling every 2 seconds, incurring high request costs from empty receives. Which change most reduces polling cost?

  1. Poll more frequently to catch messages sooner.
  2. Switch to long polling so each receive waits for messages, drastically cutting empty receives.
  3. Increase the visibility timeout.
  4. Add more queues to spread the load.
Correct answer: B. Correct: Long polling consolidates waits, reducing billable empty receives. Why others are wrong: A) More frequent polling increases empty receives and cost. C) Visibility timeout does not change polling behavior. D) More queues multiply the polling cost.

17. A company serves its API through CloudFront with an ALB origin in us-east-1. To survive a regional outage, it deployed a standby ALB in us-west-2. How should CloudFront be configured for automatic regional failover?

  1. Point the distribution at both ALBs in a single origin using DNS round-robin.
  2. Create a second distribution for the standby ALB.
  3. Configure an origin group with the us-east-1 ALB as primary and the us-west-2 ALB as secondary, failing over on error responses.
  4. Increase the TTL so edge caches mask the outage indefinitely.
Correct answer: C. Correct: Origin groups fail over between regional origins on configured error codes. Why others are wrong: A) A single origin cannot reference two ALBs with failover semantics. B) Two distributions require external DNS switching. D) Caches eventually expire; TTL increases only delay the inevitable.

18. A video transcoding company runs batch encoding jobs that are heavily CPU-bound and single-threaded per job. The workload needs the highest possible clock speed per vCPU to minimize encode time per file, and cost efficiency matters less than raw single-thread performance. Which EC2 instance family should the solutions architect recommend?

  1. Compute optimized C7i instances with high-frequency processors
  2. Memory optimized R7i instances with large RAM footprints
  3. Storage optimized I4i instances with NVMe instance store volumes
  4. General purpose M7i instances with balanced CPU-to-memory ratios
Correct answer: A. Correct: C7i compute-optimized instances use high-clock-speed processors designed for CPU-bound workloads, maximizing single-thread performance. Why others are wrong: D) M7i is general purpose with balanced ratios, not maximum clock speed. B) R7i optimizes memory, irrelevant for CPU-bound transcoding. C) I4i optimizes local NVMe storage I/O, not CPU clock speed.

19. A Kafka cluster on EC2 needs brokers distributed so that a single rack failure cannot take down multiple brokers holding replicas of the same partition. Which placement group configuration achieves this with the LEAST operational complexity?

  1. A partition placement group, placing brokers for the same partition's replicas in different partitions
  2. A spread placement group with 50 brokers in one AZ
  3. No placement group; rely on Kafka replication alone
  4. One cluster placement group for all brokers
Correct answer: A. Correct: Partition placement groups isolate racks; distributing replicas across partitions ensures a rack failure affects only one replica. Why others are wrong: D) Cluster groups co-locate brokers, worsening correlated failures. B) Spread is capped at 7 instances per AZ, insufficient for 50 brokers. C) Replication helps but correlated rack failures can still lose multiple replicas.

20. An architect must guarantee 99.999% volume durability for a financial ledger database. Which EBS choice provides this SLA?

  1. io2 / io2 Block Express
  2. st1 with RAID 10
  3. gp2 with snapshots
  4. gp3 with 16,000 IOPS
Correct answer: A. Correct: io2 volumes carry a 99.999% durability SLA, versus 99.8–99.9% for other types. Why others are wrong: D) gp3 durability SLA is 99.9%. B) st1 RAID does not change the 99.9% SLA. C) Snapshots improve recoverability but the volume SLA remains 99.9%.

21. A weather forecasting model writes checkpoints every 10 minutes and needs the file system to survive the loss of a single file server without job failure. Which Lustre deployment type provides this resilience?

  1. Scratch deployment
  2. Persistent deployment with redundant file servers
  3. Scratch 2 deployment
  4. Any deployment; Lustre is always replicated
Correct answer: B. Correct: Persistent deployments replicate data and use redundant file servers for high availability; scratch deployments do not replicate. Why others are wrong: A) and C) Scratch deployments offer no replication — server loss loses data. D) Only persistent deployments provide HA.

22. An application performs 8,000 PUTs/sec of 1 MB objects spread across 8 prefixes and still sees throttling. Each prefix sustains ~3,500 PUTs/sec. What is the BEST next step?

  1. Reduce object size
  2. Add more prefixes to spread load (e.g., 16+ prefixes)
  3. Enable Transfer Acceleration
  4. Switch to S3 Intelligent-Tiering
Correct answer: B. Correct: Per-prefix partitions cap throughput; more prefixes add more partitions, raising aggregate request capacity. Why others are wrong: C) Acceleration does not raise request-rate limits. D) Storage class is irrelevant to request rates. A) Smaller objects increase request count, worsening throttling.

23. A read-heavy leaderboard app uses DAX. After a deployment, users see stale scores for several minutes. What is the likely cause?

  1. DynamoDB throttling
  2. GSI eventual consistency
  3. Partition key hot spots
  4. DAX write-through delay; use cache invalidation or shorter TTLs / write-around strategy
Correct answer: D. Correct: DAX caches reads; without invalidation, updates take effect only after TTL expiry, causing staleness. Why others are wrong: A) Throttling causes errors, not staleness. B) GSIs are not in this path. C) Hot partitions cause throttling, not stale cache data.

24. Multiple analytics services (Athena, EMR, Redshift Spectrum) need a shared table schema over S3 data. Which service provides the central metadata store?

  1. S3 Inventory
  2. AWS Glue Data Catalog
  3. DynamoDB
  4. RDS
Correct answer: B. Correct: The Glue Data Catalog is the central Hive-compatible metastore shared by Athena, EMR, and Spectrum. Why others are wrong: C) DynamoDB is NoSQL, not a table metastore. D) RDS is relational, not a data-lake catalog. A) S3 Inventory lists objects, not schemas.

25. A company runs 40 EC2 instances 24/7 for a SaaS application with stable, predictable usage expected to continue for at least a year. Which pricing approach will minimize compute costs?

  1. Purchase 1-year Compute Savings Plans covering the steady-state usage
  2. Run all instances as On-Demand with no commitment
  3. Run all instances as Spot Instances
  4. Run all instances on Dedicated Hosts
Correct answer: A. Correct: steady-state, predictable 24/7 usage qualifies for the deepest commitment discounts, and Compute Savings Plans offer up to 72 percent off On-Demand while remaining flexible across instance families, sizes, regions, and even Fargate and Lambda. Why others are wrong: B) On-Demand with no commitment pays the full hourly rate and is the most expensive option for constant workloads. C) Spot Instances can be interrupted with two minutes notice and are unsuitable as the primary capacity for a stable production workload. D) Dedicated Hosts add a single-tenancy premium for compliance or licensing needs and do not reduce cost.

26. A company is building a new data lake. Access patterns for the incoming datasets are completely unknown: some data may be read daily, some may sit untouched for months. Which S3 storage class minimizes cost without requiring the team to predict access patterns?

  1. S3 Standard-IA
  2. S3 Glacier Flexible Retrieval
  3. S3 Intelligent-Tiering
  4. S3 One Zone-IA
Correct answer: C. Correct: Intelligent-Tiering automatically moves objects between frequent, infrequent, and archive access tiers based on observed patterns, with no retrieval fees, so unknown patterns cost-optimize themselves. Why others are wrong: A) Standard-IA charges per-GB retrieval fees that punish frequently accessed data if the guess is wrong. B) Glacier Flexible Retrieval has restore delays of hours, unusable for data that might be needed immediately. D) One Zone-IA sacrifices AZ redundancy and still charges retrieval fees on hot data.

27. A fleet of 200 EC2 instances uses gp2 volumes. The workloads need at most 3,000 IOPS per volume. Which change reduces EBS cost while maintaining performance?

  1. Migrate the gp2 volumes to gp3
  2. Migrate the gp2 volumes to io2
  3. Increase the size of each gp2 volume
  4. Migrate the gp2 volumes to sc1
Correct answer: A. Correct: gp3 costs about 20 percent less than gp2 and includes 3,000 baseline IOPS regardless of volume size, so it meets the requirement more cheaply. Why others are wrong: B) io2 is a premium provisioned-IOPS volume for extreme workloads and costs far more than gp3. C) Larger gp2 volumes raise cost because gp2 IOPS scale with size. D) sc1 is a cold HDD volume with very low IOPS, unsuitable for general-purpose instance storage.

28. A production workload runs on db.m6i (Intel-based) RDS instances. The database engine and application are compatible with ARM. Which change offers about 20 percent better price-performance?

  1. Stay on db.m6i instances
  2. Move to Dedicated Hosts
  3. Increase to larger db.m6i instances
  4. Migrate to db.m7g Graviton-based instances
Correct answer: D. Correct: Graviton-based db.m7g instances deliver up to 20 percent better price-performance than comparable Intel db.m6i instances for supported engines. Why others are wrong: A) Staying on Intel leaves the Graviton discount unclaimed. B) Dedicated Hosts add single-tenancy premiums for licensing needs, not savings. C) Larger Intel instances raise cost instead of improving price-performance.

29. A company runs hundreds of AWS Lambda functions on x86_64. The code is pure Python with no native dependencies. How can it cut Lambda compute cost with minimal effort?

  1. Keep x86_64 architecture
  2. Switch the functions to arm64 (Graviton2) architecture
  3. Enable provisioned concurrency on all functions
  4. Double the memory of each function
Correct answer: B. Correct: arm64 Lambda functions cost about 20 percent less per millisecond than x86_64, and pure Python code typically runs unchanged on ARM. Why others are wrong: A) Staying on x86_64 pays the higher per-millisecond rate. C) Provisioned concurrency adds hourly charges for capacity that may sit idle. D) Doubling memory doubles the per-millisecond price without benefit.

30. A data warehouse on Amazon Redshift runs steady analytics queries 24/7 with predictable capacity needs. Which option minimizes cost?

  1. Redshift Serverless for all workloads
  2. Larger node types
  3. Frequent cluster resizing
  4. Provisioned Redshift with Reserved Instances for the steady baseline
Correct answer: D. Correct: steady 24/7 warehouse load is ideal for provisioned nodes plus Reserved Instance discounts, which beat Serverless per-query pricing for constant usage. Why others are wrong: A) Serverless charges per RPU-hour and costs more under constant load. B) Larger nodes raise cost without addressing the pricing model. C) Frequent resizing adds operational churn without a discount mechanism.

Get full access

One payment unlocks the online question bank and the full PDF.

$10 · 3 months access

Get full access Also available on Udemy Download the free sample PDF (30 questions)

15-day money-back guarantee (before 25% of questions attempted). PDF downloads are non-refundable.

Exam facts: AWS Certified Solutions Architect – Associate (SAA-C03)

  • Exam: AWS Certified Solutions Architect – Associate (SAA-C03)
  • Cost: $150 USD
  • Duration: 130 minutes
  • Questions: 65 — multiple choice and multiple response (50 scored, 15 unscored)
  • Passing score: 720 (scaled score of 100–1,000)
  • Validity: 3 years

Frequently asked questions

How long do I get access?

Three months (90 days) from purchase, covering both the interactive online bank and the full PDF download. Access can be extended.

Is there a free trial?

Yes — a free 30-question sample quiz and a free sample PDF are available with no account required, so you can judge the quality before paying.

Are these questions like the real SAA-C03 exam?

All 730 questions are mapped to the official SAA-C03 exam objectives, written in the same style and difficulty as the real exam.

Can I study offline?

Yes. Your purchase includes the complete question bank as a downloadable PDF for offline study.

What is the refund policy?

Full access is refundable within 15 days, or before 25% of the questions have been attempted — whichever comes first. Downloaded PDFs are non-refundable.

How much does the SAA-C03 exam cost?

The AWS Certified Solutions Architect – Associate exam costs $150 USD.

How many questions are on the SAA-C03 exam?

65 questions in 130 minutes — multiple choice and multiple response. 50 questions are scored and 15 are unscored trial questions, and you can't tell which is which during the exam.

What is the passing score for SAA-C03?

720 on AWS's scaled score range of 100 to 1,000. Scoring is compensatory — you need to pass the exam overall, not each section.

How long is the Solutions Architect Associate certification valid?

Three years. Before it expires, you can recertify by passing the latest version of this exam or by earning the Solutions Architect – Professional certification.

Where can I practice for the SAA-C03 exam for free?

Right here on CertCrack. Start with the free 30-question sample quiz and the free sample PDF on this page — no account needed — and read the free Solutions Architect study guidebook. When you're ready for the full bank, this page gives you every practice question with detailed explanations for $10.

Get a free practice question every week

Join the list — one exam-style question with a full explanation, every week. No spam.